Thanks Florence. That was the way I had intended to do it (I've studied the process
quite some time ago, enough that the guide I was studying got deleted), only my mind
slipped when writing up the mail.
Still, I can't run: "getcert list -d /var/lib/pki-ca/alias -n "subsystemCert
cert-pki-ca" | grep post-save"
or the "getcert stop-tracking ..." steps as there is no /var/lib/pki-ca on my
system. Only /var/lib/pki/pki-tomcat.
I have CS.cfg in:
/etc/pki/pki-tomcat/ca/CS.cfg
/usr/share/pki/ca/conf/CS.cfg
/var/log/pki/server/upgrade/10.0.5/1/oldfiles/var/lib/pki/pki-tomcat/conf/ca/CS.cfg
/etc/pki/pki-tomcat contains both the ca and alias subdirs, if I substitute this and
continue, I get to a different obstacle:
"getcert list -d /var/lib/pki/pki-tomcat/alias -n "subsystemCert
cert-pki-ca""
returns "No request found that matched arguments."
Only if I run "getcert list" without arguments I get the long list and details
about each certificate:
getcert list | grep "subsystemCert cert-pki-ca"
key pair storage:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert
cert-pki-ca',token='NSS Certificate DB',pin='xxxxxxxxxxxx'
certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert
cert-pki-ca',token='NSS Certificate DB'
post-save command: /usr/lib64/ipa/certmonger/renew_ca_cert "subsystemCert
cert-pki-ca"
This means this is the master?
If there is such a difference in the behavior (output) of getcert on my system, how can I
assume the other getcert commands in the process will work? (iow, they likely won't?)
----- Izvirno sporočilo -----
Od: "Florence Blanc-Renaud" <flo(a)redhat.com>
Za: "FreeIPA users list" <freeipa-users(a)lists.fedorahosted.org>
Cc: "Jernej Jakob" <jernej.jakob(a)abak.si>
Poslano: Četrtek, 7. Februar 2019 16:50:03
Zadeva: Re: [Freeipa-users] Upgrading from V3 on Fedora to V4 on CentOS, CA promotion
steps?
[...]
Hi,
please find more information here: Migrating IdM from RHEL6 to 7 [1].
The direct upgrade from IdM 3.x to 4.x is not supported, the recommended
path is to install a 4.x replica from the 3.x master (with all the
needed services, for instance CA, DNS, etc...) then decommission the 6.x
master.
HTH,
flo
[1]
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/...
[...]